Why the DOJ and an internet company are heading to court over data from an anti-Trump protest website

BY    | Updated: Aug 24, 2017 at 1:05 PM
Protesters block members of the press as they chain themselves to an entry point prior at the inauguration of U.S. President-elect Donald Trump in Washington, DC, U.S., January 20, 2017. REUTERS/Bryan Woolston - RTSWGFD

Protesters block members of the press as they chain themselves to an entry point prior at the inauguration of U.S. President-elect Donald Trump in Washington, DC, U.S., January 20, 2017. REUTERS/Bryan Woolston – RTSWGFD

UPDATE: A D.C. Superior Court judge ruled Thursday that DreamHost must comply with a scaled-back Department of Justice demand for data from DisruptJ20.org, an inauguration protest website it hosts.

Last week, DreamHost said it would not comply with a DOJ demand for over one million visitor IP addresses and other data from the website.

On Monday, ahead of a Thursday hearing in D.C. Superior Court, the government dropped the request for visitor IP logs and drastically narrowed the warrant’s scope, writing that it had “no interest” in the kind of sweeping data it initially requested.

Here’s a look at what happened, and what comes next.

Why did DOJ make its original request?

Federal prosecutors said Disruptj20.org was used to plan a violent riot on Inauguration Day in Washington, D.C., that caused extensive property damage and injured six police officers.

The demand to DreamHost is part of a larger case the DOJ is building against more than 100 Inauguration Day protesters. Jury trials for those cases are set to begin in October.

A D.C. Superior Court judge approved the government’s search warrant for the visitor IP addresses, among other data, in early July. The U.S. Attorney’s Office says DreamHost refused to comply so they filed a motion to compel DreamHost to do so. DreamHost will have to now make its case Thursday before a D.C Superior Court.



Government Motion to Show Cause July 2017 (Text)

Why was this a big deal?

DreamHost and privacy advocates said the warrant was “a strong example of investigatory overreach and a clear abuse of government authority.”

“That information could be used to identify any individuals who used this site to exercise and express political speech protected under the Constitution’s First Amendment. That should be enough to set alarm bells off in anyone’s mind,” DreamHost wrote in a blog post.

How often does a request like this happen?

It is standard for the government to request an expansive amount of electronic records — the entirety of a suspect’s emails, for instance — and then search through those records for the particularly described evidence.

It is unusual, however, to see a warrant for an entire website, said Orin Kerr, a law professor at George Washington University Law School and a computer crime law expert.

When it comes to the physical realm — a car, apartment or an office — what constitutes a reasonable search and seizure is well established and on a practical level, more clear cut.

But “there is not well established case law on this when it comes to the digital realm,” Kerr said.

How and why did the DOJ’s request change?

Prosecutors defend the original warrant but say that they did not realize DreamHost had such a large amount of visitor data, or in turn, that their request would be so sweeping.

“What the government did not know when it obtained the Warrant — what it could not have reasonably known — was the extent of visitor data maintained by DreamHost that extends beyond the government’s singular focus in this case of investigating the planning, organization, and participation in the January 20, 2017 riot,” prosecutors wrote, while defending the original warrant.

(A July email included in DreamHost’s response to the original warrant shows DreamHost did alert federal prosecutors that their warrant “seeks the IP addresses of over 1 million visitors to the website.”)



Government_ModifyingDreamhostSearchWarrant_August 2017 (Text)

The U.S. attorney’s D.C. office said its request was not about the first amendment, but rather, trying to prove protesters had premeditated and organized violent demonstrations on Inauguration Day.

The new warrant is narrower in scope, seeking not the IP addresses of every visitor to the site but instead for records of focused, private groups that were organized through the website. The modified warrant would also specify the time frame for records it requests and exclude draft posts and photos that were never published on the website.

“The warrant is focused on evidence of the planning, coordination and participation in a criminal act — that is, a premeditated riot,” the government wrote in its new court filing.

Either way, “I think it was wise for the DOJ to file this revised warrant” Chris Ghazarian, DreamHost’s general counsel, told the Newshour on Tuesday. “This is a huge victory for DreamHost, and, more importantly, for the public.”

What’s next?

At a hearing Thursday morning in D.C. Superior Court, a judge said the government could proceed with its warrant, but with several conditions.

The court said the government’s search of data from DisruptJ20 must continue under court supervision. As part of this new court supervised process, prosecutors must draft a framework of how they plan to search this data with the court and specify how they plan to minimize exposure of people’s information who are not connected to their criminal investigation.

The judge also ruled that the data that is searched but deemed irrelevant to the investigation must be sealed.

Dreamhost still had concerns with the revised warrant filed Monday which dropped the request for visitor IP addresses.

The company’s attorneys told reporters outside the courtroom that they are considering appealing this decision, saying that today’s order would still expose thousands of innocent users.

SHARE VIA TEXT